iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
0answers
343 views

iptables IP address (source and destination IP address) mangling

I tried to understand the concept of iptables mangling part, but somehow failed to understand the IP header manipulative section. For example: Below is the system scenario which I'm trying to ...
0
votes
1answer
616 views

conntrack in iptables not working [closed]

I have tried to use conntrack in my iptables rules, however I keep getting an error. I've tried aminimal example with just one line and the error appears as well. admin@server:/home/admin/skrypty# ...
1
vote
2answers
267 views

Forward port 22 out a particular interface

The situation I'm in is where we have three separate interfaces on a particular machine. Each connected network only allows servers (by network-based routing/firewalling) to only offer particular ...
0
votes
0answers
271 views

how to route traffic on port to ip:port on linux?

I'm trying to route all traffic on port udp 5000 to udp 192.168.0.1:12333 with the following command: $ iptables -t nat -A PREROUTING -p udp -m udp --dport 5000 \ -j DNAT --to 192.168.0.1:12333 ...
1
vote
1answer
2k views

unable to initialize table filter

I have a firewall file saved in /etc/firewall.conf. Everything is ok, I can use it for iptables-restore /etc/firewall.conf with success. So, starting from this file, I created a PHP script(that runs ...
1
vote
3answers
62 views

Why did this iptables rule block my webserver?

I was setting up Mathematica on a remote server, and needed access to the UI. I set up VNC according to http://wiki.centos.org/HowTos/VNC-Server , and got it working, which involved making an ...
2
votes
0answers
62 views

VPN tunnel to two services on two servers?

I've got 2 CentOS 6.5 servers, each running one service: server A: 10.140.54.1/27 running service MySQL port 3306 server B: 10.140.54.2/27 running service httpd port 443 Server B's httpd service ...
1
vote
0answers
497 views

iptables: can't open tcp port

I'm running a Raspberry PI B+: Linux pi 3.12.28+ #709 PREEMPT Mon Sep 8 15:28:00 BST 2014 armv6l GNU/Linux The Raspberry is connect via lan (dhcp. ip: 192.168.78.29) to the local network. I'm trying ...
1
vote
0answers
89 views

Transparent proxy to other IP of thousand ports

I was bought a service that only allow a IP, the IP that i say, only one, but I need use this from more IP's. I think that I can install in this computer a system to do a transparent proxy for ...
3
votes
1answer
177 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
1
vote
0answers
48 views

iptables packet header capture and compare

We are using multicast program to listen up multicast data from our provider, there are couple cases where the multicast having issue: 1. their server hang, hence no multicast data received from our ...
2
votes
0answers
699 views

how to open up socks/SSH on different network interfaces?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
1answer
36k views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: root@...
1
vote
0answers
74 views

How to route pakets from an aliased interface towards a gateway?

I'm having trouble setting up the following: Router IP: 192.168.1.1 PC Eth0 - 192.168.1.104 Eth0:1 - 10.0.0.1 (must be an alias) Besides ip_forward enabled, what should I add to iptables rules, so ...
2
votes
3answers
159 views

Bridge/Router with custom logic

I've a Linux box with 3 network adapaters, which I'd like to configure as follow: Adapter A is connected to computer A Adapter B is connected to computer B Adapter C is connected to the Internet. ...
1
vote
0answers
129 views

Forwarding DNS traffic for specific domain

I'm trying to control which IP address I use for DNS based on the domain string. I'm on Fedora with firewalld and have tried the command: firewall-cmd --direct --add-rule ipv4 filter PREROUTING 0 -t ...
0
votes
1answer
479 views

iptables NAT on Debian openvz

So i want to create a nat rule for an openVPN server. After getting trouble with the TAP/TUN Devices, it's finally working i think. Now i have to make a nat rule like so : >iptables -t nat -A ...
9
votes
1answer
3k views

How does a transparent SOCKS proxy know which destination IP to use?

There are two SOCKS proxies that I know about that support transparent proxying for any outgoing TCP connection: Tor and redsocks. Unlike HTTP proxies, these SOCKS proxies can transparently proxy any ...
2
votes
1answer
198 views

iptables, what is truly open?

We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, ...
1
vote
1answer
153 views

How to wrap iptables commands around Ruby webrick server going up and down in a single command/script?

I would like to use this Ruby WEBrick server solution for on-demand showcasing of some random web pages. So I set up some forwarding exception on my adsl modem local web interface(192.168.2.1). Then ...
2
votes
1answer
1k views

How to completely block a website like Facebook?

I'm trying to block Facebook access from my home system (Ubuntu). I could add facebook.com to /etc/hosts, but that would only prevent accessing facebook.com. There are many other ways I could use ...
3
votes
2answers
861 views

Is there a specific reason why iptables would return an exit code of 3 (instead of 1?) when executed without sufficient privileges?

I simply forgot to use sudo: usr@arch ~[0] $ iptables -L iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be ...
4
votes
1answer
508 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
24 views

Making sense of this iptables http proxy config

I've never touched iptables before and I'm trying to understand exactly what these three lines do. I have ip_forward switched on and I know the end effect is that all traffic on eth0 is forwarded ...
1
vote
1answer
233 views

Can I forward all traffic on a port to a complete different IP address?

Here's my situation. I own a VPS that provides 3 public IPs / public interfaces. let's call these IP address V1 (on eth1), V2(on eth2) and V3 (on eth3) At home, I have a router. The home WAN IP is H. ...
-1
votes
1answer
31 views

iptables fowarding rules

I have an iptables rule in the FORWARD section that looks like this: 17 0 0 CONFIRMED tcp -- * * 0.0.0.0/0 172.16.30.240 tcp spt:587 dpt:587 ctorigdst 24.103....
0
votes
1answer
76 views

What means the numbers besides my default policy chain rules?

I am investigating a potential security issue in one of my system. My firewall tables currently look as, :INPUT ACCEPT [527:57388] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [189:35832] -A INPUT -p tcp -m ...
1
vote
0answers
263 views

Only allow http and SSH traffic

I ran the below. What I expected was to be able to browse websites without issues. No sites work and I have no idea what. When I executed iptables -P OUTPUT ACCEPT it works so I'm assuming I missed an ...
1
vote
0answers
221 views

IPTable rules for transparent outbound proxy

I've recently installed MITMProxy (similar to Squid) which I'm currently using to route outbound HTTP requests from my Ubuntu machine to another server (adding a header along the way). When I use ...
1
vote
0answers
697 views

Setting up a 802.11s mesh network for mobile devices to communicate with a wired server

I'm in the process of developing an android app that maintains a device's connectivity to a linux-based WiFi mesh network, and periodically sends status information (GPS, battery life, etc.) to a ...
4
votes
2answers
385 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
3
votes
3answers
992 views

How to get all IPtables rules

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try: iptables -L -n I only get one rule (which I entered 5 minutes ago). I have many others, for port 80, mysql ...
6
votes
2answers
10k views

set packet rate limit via iptables

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected. How ...
0
votes
1answer
459 views

Isolate subnets on the same interface

I need to isolate Subnets on a linux machine CentOS that act as gateway. I have the following scenario. CentOS eth0 pub ip addres eth0.1 192.168.1.1 eth0.2 192.168.2.1 Now eth0.1 and eth0.2 can ...
-1
votes
1answer
164 views

Fail2ban consuming lot of bandwith

I have a raspberry pi on which I have a nginx and a ssh server, I have installed iptables and fail2ban in order to limit the attempts of ssh connection. The problem is that it seems that fail2ban ...
1
vote
0answers
56 views

NAT-T set up using 3 linux machines

I am trying to have a simple NAT-T setup using 3 linux machines. Linux1 Linux2(NATdevice) Linux3 (eth0) 192.168.1.51 <--->(eth1)192.168.1.80 & (...
0
votes
1answer
561 views

IPTABLES comment: No chain/target/match by that name

Faced with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without ...
0
votes
1answer
282 views

IPtables don't block IP

I'm running Postfix SMTP server. Some hosts trying to connect with wrong passwords. warning: s15393678.onlinehome-server.com[74.208.17.126]: SASL LOGIN authentication failed: I'm adding iptables ...
3
votes
0answers
57 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
3
votes
1answer
1k views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
0
votes
1answer
441 views

CentOS 7 iptables problems and doubts?

I have a CentOS 7 image on VM VirtualBox (bridged Ethernet with static IP) I was trying to set iptables filter table but I have the following problems: Whatever I did to open Apache on port 80 doesn'...
5
votes
4answers
21k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
1
vote
1answer
114 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
1
vote
0answers
175 views

What is the point of the second route lookup after OUTPUT?

According to the packet path diagram, and its description: Table 6-2. Source local host (our own machine) [...] Routing decision, since the previous mangle and nat changes may have ...
2
votes
0answers
421 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
0
votes
1answer
302 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
2
votes
1answer
2k views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
2k views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
288 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
6
votes
2answers
7k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...